mirror of
https://github.com/edera-dev/sprout.git
synced 2026-11-04 21:42:23 +00:00
alex
2e643d8081
The concurrency groups included the commit SHA, so every run was in a group of its own and cancel-in-progress never cancelled a run that a newer push had replaced. Group runs by pull request or ref instead. Only pull request runs are cancelled, so every push to main still gets fully checked and published.
51 lines
1.4 KiB
YAML
51 lines
1.4 KiB
YAML
name: zizmor
|
|
|
|
on:
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
permissions:
|
|
contents: read # Needed to checkout the repository.
|
|
|
|
concurrency:
|
|
group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}"
|
|
# Only cancel superseded pull request runs, so every push to main is fully checked.
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
zizmor:
|
|
name: zizmor
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
security-events: write # Needed to upload code scanning results.
|
|
contents: read # Needed to checkout the repository.
|
|
actions: read # Needed to analyze action metadata.
|
|
steps:
|
|
- name: harden runner
|
|
uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: setup uv
|
|
uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
|
|
|
|
- name: zizmor
|
|
run: uvx zizmor --pedantic --format sarif . > results.sarif
|
|
env:
|
|
GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
|
|
|
|
- name: upload
|
|
uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
|
|
with:
|
|
sarif_file: results.sarif
|
|
category: zizmor
|